# Filebeat is not taking new entries from overwritten file

**URL:** <https://discuss.elastic.co/t/filebeat-is-not-taking-new-entries-from-overwritten-file/79062>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 17, 2017, 4:46pm UTC](https://discuss.elastic.co/t/filebeat-is-not-taking-new-entries-from-overwritten-file/79062 "2017-03-17T16:46:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [March 17, 2017, 4:46pm UTC](https://discuss.elastic.co/t/filebeat-is-not-taking-new-entries-from-overwritten-file/79062/1 "2017-03-17T16:46:29Z")

</div>

Hi,

I am using ELK GA 5.0.0. In my Linux box, I am pushing `vmstat` entries to a file using the following shell script;

```
#!/bin/bash
while true
do
	>vmstatlog.log
	echo "`vmstat`"$'\n' >> vmstatlog.log
	sleep 2
done

```

The script is designed to empty the contents of the file `vmstatlog.log` and then writes to it. In this way, the file keeps only latest entry. But the problem is, my filebeat takes only one entry, after that no output is sent by filebeat. I checked the file and found that it gets updated every time. Whats wrong here, and how can I fix this?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 17, 2017, 5:59pm UTC](https://discuss.elastic.co/t/filebeat-is-not-taking-new-entries-from-overwritten-file/79062/2 "2017-03-17T17:59:37Z")

</div>

The file will keep the same inode so Filebeat will not know to reread the whole file. To see this, add `stat vmstatlog.log` to the loop and you will see that the inode value never changes.

If you create a new file each time, then it will have a different inode, and Filebeat will read it.

---

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [March 17, 2017, 8:19pm UTC](https://discuss.elastic.co/t/filebeat-is-not-taking-new-entries-from-overwritten-file/79062/3 "2017-03-17T20:19:15Z")

</div>

Hi

I have changed the script like below;

```
#!/bin/bash
while true
do
	rm vmstatlog.log
	echo "`vmstat`"$'\n' >> vmstatlog.log
	sleep 2
done

```

Still same effect 😞

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 20, 2017, 10:24am UTC](https://discuss.elastic.co/t/filebeat-is-not-taking-new-entries-from-overwritten-file/79062/4 "2017-03-20T10:24:40Z")

</div>

Can you share your filebeat config and filebeat log output?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2017, 10:25am UTC](https://discuss.elastic.co/t/filebeat-is-not-taking-new-entries-from-overwritten-file/79062/5 "2017-04-17T10:25:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.